Which four roles take part in SAML web single sign-on, and what does each do?
The identity provider authenticates users and issues assertions, the service provider offers the resource and accepts assertions from a trusted IdP, the subject is the user, and the user agent is the browser that carries the messages.
| Role | Who it is | Job |
|---|---|---|
| Identity provider (IdP) | The login service of the home organisation | Authenticates the user and issues signed assertions to service providers |
| Service provider (SP) | The application | Offers a service or resource and accepts assertions issued by an IdP it trusts |
| Subject | The user | Has authenticated at the IdP and wants to access a resource at the SP |
| User agent (UA) | Usually a web browser | The client the user operates; it relays SAML messages between SP and IdP |
The user agent is easy to overlook but central to the design: in browser SSO, the IdP and SP usually never talk to each other directly. Every request and response travels through the browser via redirects and auto-submitted forms. That keeps deployment simple (no firewall openings between partners) but also means the browser is a place where assertions can be stolen, which drives most of SAML's security discussion.
In SAML's general terminology the IdP is the asserting party and the SP is the relying party.
Go deeper:
OASIS: SAML V2.0 Technical Overview — section 3.1 defines the participants and their roles.